🇫🇮Data Protection Act (1050/2018)

← Back to laws in Finland

Data Protection Act (1050/2018)

Finland applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Act supplements the GDPR in Finland, extends selected GDPR rules outside EU-law scope and adds Finnish rules for children, sensitive and criminal data, identifiers, research, expression, rights restrictions and enforcement.

National additions and variations

• Section 5 sets 13 as the age at which a child may consent to a directly offered information-society service.
• Sections 6 and 7 provide national routes for special-category and criminal-offence data and require suitable specific safeguards such as access controls, logging, training, pseudonymisation, encryption and testing.
• Section 29 limits use and display of the Finnish personal identity code and prohibits identifying a person solely by the code, or by the code together with the person's name.
• Sections 31 and 32 condition research, statistics and archiving rights derogations; a DPIA or qualifying code is required for specified special-category or criminal-data research derogations and the DPIA must be sent to the Ombudsman before processing.
• Sections 35 and 36 impose confidentiality and protect the identity of a person reporting a suspected infringement where disclosure could harm the reporter.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.